Microsoft is releasing this security advisory to provide information about a vulnerability in file ownership in Linux .NET tarball distributions, including ASP.NET Core runtime tarballs, ASP.NET Core Targeting Pack tarballs, and source-built .NET tarballs.
Incorrect ownership of runtime files installed from affected Linux tarballs can allow local elevation of privilege.
For Microsoft-published .NET 8 and .NET 9 distributions, only the ASP.NET Core runtime and targeting-pack Linux tarballs are affected. For source-build, every Linux tarball type is affected. Other Microsoft-published .NET runtime and SDK tarballs, and standalone NuGet packages, are not included in this scope.
The source-build product versions identify the corresponding SDK release.

CNA: microsoft
CNA impact: Elevation of Privilege
CWE: CWE-276
Platforms: linux
Architectures: all
CVSS 3.1: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Affected products:
- ASP.NET Core Runtime (release 8.0): 8.0.0 - 8.0.32; fixed 8.0.33
- .NET SDK (release 8.0): 8.0.100 - 8.0.132; fixed 8.0.133
- .NET SDK (release 9.0): 9.0.100 - 9.0.122; fixed 9.0.123
- .NET SDK (release 11.0): 11.0.100-preview.1.26104.118 - 11.0.100-rc.2.26504.105; fixed 11.0.100-rc.3.26522.148
- .NET SDK (release 10.0): 10.0.100 - 10.0.113; fixed 10.0.114-servicing.26522.126
- .NET SDK (release 10.0): 10.0.400 - 10.0.402; fixed 10.0.403-servicing.26523.112
- ASP.NET Core Runtime (release 9.0): 9.0.0 - 9.0.21; fixed 9.0.22